Website shows up different code to Google as Googlebot, that is suspicious and called cloaking: http://isithacked.com/check/http%3A%2F%2Fwww.portalcienciayficcion.com%2F (52 bytes difference).
SRI hashes not generated B-status: https://sritest.io/#report/ea972b33-456a-4b99-b45b-2ad2931296f4
And then this: http://retire.insecurity.today/#!/scan/3406a6bb382f55c11855c888ded3cc8fdc6f0a8abb4c353b4db69e008c593df8
About this particular script I wrote recently - XSS-Dom attack vulnerable: https://forum.avast.com/index.php?topic=204977.msg1406113#msg1406113 - could be because you used something like this: https://www.w3schools.com/tags/tryit.asp?filename=tryhtml5_input_type_hidden
In your website’s case, these were not shown: Rover Curiosity.jpg and Blade runner.jpg, that is all we know.
polonus
